AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

bkpr: helpers to query sql plugin for chainmoves and channelmoves.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
bkpr: helpers to query sql plugin for chainmoves and channelmoves.

We're going to be using this instead of our internal db.

I also made json_out_obj() take the str arg, as it didn't and I
expected it to.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds bookkeeping helpers that let the bkpr plugin ask the separate sql plugin for transaction data instead of using its own internal database. It also fixes a memory-handling quirk in a shared JSON helper so it can accept strings that are marked as 'take ownership' (TAKES). The commit itself is a feature/refactoring change; it does not fix a known vulnerability and does not claim to be security-relevant.

Recommended action

No immediate action required. Treat as normal feature/refactoring commit. If reviewing the broader migration to the sql plugin, prioritize replacing sql_string() quote-escaping with proper bound parameters, and verify that json_out_obj() callers do not double-free after the TAKES change.

Security signals we found

01

New SQL string escaping helper added (sql_string) to quote single quotes, indicating awareness of SQL injection risk but using manual escaping rather than bound parameters

02

FIXME comment in sql.h explicitly states 'The sql plugin should support bound parameters to avoid this!'

03

json_out_obj() now handles TAKES strings and frees them, fixing a likely latent memory/ownership bug in plugin JSON construction

04

No assertion of security relevance, CVE, or bug fix in commit message or title

Risk score

Why this scored 15/100

Our methodology →
Potential impact 2/30
Exploitability 3/25
Stealth signal 2/15
Affected reach 3/15
Confidence 3/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.